CLAIM AMENDMENTS 

1. (currently amended) In a system comprising: 

a root entity, the root entity maintaining a root certification authority adapted to issue a 
digital certificate to each of a first participant and a second participant , th e root e ntity furth e r 
maintaining a c e ntral r e pository ; 

the first participant maintaining a first certification authority adapted to issue a digital 
certificate to a first customer; 

the second participant maintaining a second certification authority adapted to issue a 
digital certificate to a second customer; 

a method for providing authorization services, said method comprising: 

generating by the second customer an authorization request to confirm the authority of an 
individual to act on behalf of the first customer , wherein the first customer has contacted the 
second customer but has not sent a digital signature to the second customer ; 

transmitting the authorization request from the second customer to the second participant; 

transmitting the authorization request from the second participant to the first participant; 

retrieving at the first participant information concerning the authority of the individual to 
act on behalf of the first customer and at least one or mor e rul e s rule for responding to the 
authorization request; 

generating by the first participant an authorization response using the retrieved 
information and rules; 

transmitting the response from the first participant to the second participant; and 

transmitting the response from the second participant to the second customer. 

2 (currently amended) The method of claim 1 , wherein the authorization request is a 
dynamic request as to whether the individual is authorized to perform a certain act or undertake a 
particular transaction . 

3 (currently amended) The method of claim 1 , wherein the authorization request is a 
static request for an attribute of a role associated with the individual . 

4 (canceled) 
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5 (original) The method of claim 1 , wherein access controls are implemented that limit 
the ability of the second customer to obtain a message format for the authorization request. 

6 (currently amended) The method of claim 1 , wherein d e finition information pertaining 
to definitions of attributes is used in preparing the authorization response. 

7 (currently amended) The method of claim 1 , wherein mapping information pertaining 
to mapping terminology from the second customer to the first customer is used in preparing the 
authorization response. 

8 (original) The method of claim 7, wherein the mapping information comprises dynamic 
mapping information. 

9 (original) The method of claim 1 , wherein the authorization request seeks confirmation 
that the individual is authorized to purchase goods on behalf of the first customer. 

10 (currently amended) Th e m e thod of claim 1 , In a system comprising: 

a root entity, the root entity maintaining a root certification authority adapted to issue a 
digital certificate to each of a first participant and a second participant; 

the first participant maintaining a first certification authority adapted to issue a digital 
certificate to a first customer; 

the second participant maintaining a second certification authority adapted to issue a 
digital certificate to a second customer; 

a method for providing authorization services, said method comprising: 

generating by the second customer an authorization request to confirm the authority of an 
individual to act on behalf of the first customer, wherein the first customer has contacted the 
second customer but has not sent a digital signature to the second customer; 

transmitting the authorization request from the second customer to the second participant; 

transmitting the authorization request from the second participant to the first participant; 

retrieving at the first participant information concerning the authority of the individual to 
act on behalf of the first customer and at least one rule for responding to the authorization 
request; 
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generating by the first participant an authorization response using the retrieved 
information and rules; 

transmitting the response from the first participant to the second participant; and 

transmitting the response from the second participant to the second customer; 

wherein the authorization request is bundled with a certificate validation request for the- 
individual's a digital certificate of the first customer , 

1 1 (currently amended) The method of claim 4- H), wherein the first participant checks 
the validity of the first custom e r's digital certificate of the first customer . 

12 (currently amended) The method of claim 4- 10, wherein the response indicates the 
status of the first custom e r's digital certificate of the first customer . 

13 (currently amended) A method for establishing an authorization service, said method 
comprising: 

defining a proposed authorization service for confirming the authority of individuals 
and/or computers to transact on behalf of customers ; 

presenting the proposed authorization service to a policy management authority by 
sending an electronic communication to the policy management authority, wherein the proposed 
authorization service is developed by a participant and approved by the policy management 
authority before being offered to a custom e r customers ; 

receiving approval of the proposed authorization service from the policy management 
authority via an electronic communication, whereby the proposed authorization service becomes 
an approved authorization service; and 

implementing the approved authorization service. 

14 (original) The method of claim 13, wherein the proposed authorization service 
comprises a messaging specification and implementation rules. 

15 (currently amended) The method of claim 13, wherein the proposed authorization 
service is jointly developed by a customer and its a participant of the customer . 

16 (canceled) 
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17 (original) The method of claim 13, wherein the policy management authority is 
associated with a root entity. 

18 (currently amended) The method of claim 13, wherein the approved authorization 
service is implemented within the context of a four-corner model comprising a root entity, a first 
participant, a customer of the first participant, a second participant, and a customer of the second 
participant . 

19 (currently amended) Th e m e thod of claim 1, In a system comprising: 

a root entity, the root entity maintaining a root certification authority adapted to issue a 
digital certificate to a first participant and a second participant, the root entity further maintaining 
a central repository; 

the first participant maintaining a first certification authority adapted to issue a digital 
certificate to a first customer; 

the second participant maintaining a second certification authority adapted to issue a 
digital certificate to a second customer; 

a method for providing authorization services, comprising: 

generating by the second customer an authorization request to confirm the authority of an 
individual to act on behalf of the first customer; 

transmitting the authorization request from the second customer to the second participant; 

transmitting the authorization request from the second participant to the first participant; 

retrieving at the first participant information concerning the authority of the individual to 
act on behalf of the first customer and one or more rules for responding to the authorization 
request; 

generating by the first participant an authorization response using the retrieved 
information and rules; 

transmitting the response from the first participant to the second participant; and 

transmitting the response from the second participant to the second customer; 

wherein the first participant responds to the authorization request with a positive response 
only if the authorization request includes a purchase order signed by the individual. 

20 (currently amended) Th e m e thod of claim 1 , In a system comprising: 
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a root entity, the root entity maintaining a root certification authority adapted to issue a 
digital certificate to a first participant and a second participant, the root entity further maintaining 
a central repository; 

the first participant maintaining a first certification authority adapted to issue a digital 
certificate to a first customer; 

the second participant maintaining a second certification authority adapted to issue a 
digital certificate to a second customer; 

a method for providing authorization services, comprising: 

generating by the second customer an authorization request to confirm the authority of an 
individual to act on behalf of the first customer; 

transmitting the authorization request from the second customer to the second participant; 

transmitting the authorization request from the second participant to the first participant; 

retrieving at the first participant information concerning the authority of the individual to 
act on behalf of the first customer and one or more rules for responding to the authorization 
request; 

generating by the first participant an authorization response using the retrieved 
information and rules; 

transmitting the response from the first participant to the second participant; and 

transmitting the response from the second participant to the second customer; 

wherein the first participant responds to the authorization request with a positive response 
only if the authorization request includes an offer to enter into a contract by the individual. 
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